Drift Protocol Hacker Moves $122.3 Million Into Tornado Cash

‍

The Drift Protocol Exploiter deposited $122.3 million of ETH into Tornado Cash on 20 and 21 October, across 520 transfers. It is the largest Tornado Cash deposit made by any hacker in the last two years.

Below is a screenshot from Arkham showing the most recent transactions.

‍

‍

The deposits mark the first movement from the entity in six months. The funds originate from the 1 April exploit of Drift Protocol on Solana, in which the hacker stole $285 million through a malicious admin transfer. Arkham traced the funds as it happened, identifying $269.32 million leaving Drift that day, before the exploiter bridged the money onto Ethereum, where it sat dormant in four labelled addresses.

The largest outflows from Drift were:

• JLP ($155.62M)
• USDC ($51.62M)
• cbBTC ($11.29M)
• WSOL ($10.45M)
• WETH ($4.69M). 

How Did the Exploiter Move the Funds?

The deposits happened from 07:08 UTC on 20 October to 08:48 UTC on 21 October - one transfer roughly every three minutes, for 25 hours straight. The pattern was mechanical: 505 deposits of 100 ETH, 9 of 10 ETH, 5 of 1 ETH, and a single deposit of 0.1 ETH.

Every one of the 520 transfers went directly to Tornado Cash, split almost evenly across the two days: $61.39 million on 20 October and $60.92 million on 21 October. Apart from this 25-hour window, the entity has been completely dormant.

Will the Exploiter Move More?

Crypto traders will be wondering if this is a one-off or the start of a full-scale laundering operation. The numbers suggest the latter is possible: the exploiter's labelled wallets still hold $137.22 million - 56,568 ETH on Ethereum ($136.66M) plus $549K of USDY on Solana.

You can track the Drift Protocol Exploiter on Arkham using the de-anonymized entity page. You can also interact with the exploiter’s entity directly in the window below: